CVE-2021-23418

XML External Entity (XXE) Injection

Medium · published July 29, 2021

CVSS v3.1
6.3
EPSS
2%
Percentile
76.2
In the wild
Unconfirmed
What it is

The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.01639 · 76.2th percentile
Published
2021-07-29T17:50Z
EPSS history
Timeline
  • 29 JUL 17:50Z
    XML External Entity (XXE) Injection
    cvelistv5